Stuck on port 80/443 (and port mismatch with resources) #1178

New Issue

MrUnknownDE · 2026-04-05T18:27:11+02:00

MrUnknownDE commented

2026-04-05 18:27:11 +02:00

Originally created by @Error-Gap on 7/26/2025

There doesn't seem to be an easy way to get Pangolin to run properly on alternate ports. Simple changing the mapping does not work.
For example, you could have in docker-compose.yml

    ports:
      - 8443:443 # Port for traefik because of the network_mode
      - 8080:80 # Port for traefik because of the network_mode

OR, in docker-compose.yml

    ports:
      - 8443:8443 # Port for traefik because of the network_mode
      - 8080:8080 # Port for traefik because of the network_mode

and traefik_config.yml

entryPoints:
  web:
    address: "8080"
  websecure:
    address: ":8443"

This allows access to the admin interface on the alternate HTTPS port. However, once you create a resource, it will never match up and results in an error such as "Unauthorized" (and "access denied" in the logs). This is because the check will also compare the alternate port, while the resource entry apparently expects the default HTTPS port (443). You also connect specify a port in the WebUI for the resource (colon isn't an allow character).

Error Snippet (IP's and domain masked)

pangolin    | 2025-07-26T03:38:51.241Z [debug]: Verify session: Badger sent {"sessions":{},"originalRequestURL":"https://alt.mysite.com:8443/","scheme":"","host":"alt.mysite.com:8443","path":"/","method":"GET","tls":true,"requestIp":"1.2.3.4:41409","headers":{"Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8","Accept-Encoding":"gzip, deflate, br, zstd","Accept-Language":"en-CA,en-US;q=0.7,en;q=0.3","Priority":"u=0, i","Sec-Fetch-Dest":"document","Sec-Fetch-Mode":"navigate","Sec-Fetch-Site":"none","Sec-Fetch-User":"?1","Sec-Gpc":"1","Te":"trailers","Upgrade-Insecure-Requests":"1","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:141.0) Gecko/20100101 Firefox/141.0","X-Forwarded-Host":"alt.mysite.com:8443","X-Forwarded-Port":"8443","X-Forwarded-Proto":"https","X-Forwarded-Server":"7d0cda26f0c","X-Real-Ip":"1.2.3.4"}}
pangolin    | 2025-07-26T03:38:51.244Z [debug]: Request IP: {"requestIp":"1.2.3.4:41409"}
pangolin    | 2025-07-26T03:38:51.246Z [debug]: Client IP: {"clientIp":"6.7.8.9"}
pangolin    | 2025-07-26T03:38:51.249Z [debug]: Resource not found {"0":"a","1":"l","2":"t","3":".","4":"m","5":"y","6":"s","7":"i","8":"t","9":"e","10":".","11":"c","12":"o","13":"m","14":"8","15":"4","16":"4","17":"3"}
pangolin    | 2025-07-26T03:38:51.250Z [debug]: {"data":{"valid":false},"success":true,"error":false,"message":"Access denied","status":200}

Suggestion:

Strip the port when matching against a resource
or
Allow users to enter a port with the resource

(there are many reasons to run on ports other than 80+443, including firewall issues/configs or if an existing webserver etc is also binding that port)

*Originally created by @Error-Gap on 7/26/2025* There doesn't seem to be an easy way to get Pangolin to run properly on alternate ports. Simple changing the mapping does not work. For example, you could have in docker-compose.yml ``` ports: - 8443:443 # Port for traefik because of the network_mode - 8080:80 # Port for traefik because of the network_mode ``` OR, in docker-compose.yml ``` ports: - 8443:8443 # Port for traefik because of the network_mode - 8080:8080 # Port for traefik because of the network_mode ``` and traefik_config.yml ``` entryPoints: web: address: "8080" websecure: address: ":8443" ``` This allows access to the admin interface on the alternate HTTPS port. However, once you create a resource, it will never match up and results in an error such as "Unauthorized" (and "access denied" in the logs). This is because the check will also compare the alternate port, while the resource entry apparently expects the default HTTPS port (443). You also connect specify a port in the WebUI for the resource (colon isn't an allow character). Error Snippet (IP's and domain masked) ``` pangolin | 2025-07-26T03:38:51.241Z [debug]: Verify session: Badger sent {"sessions":{},"originalRequestURL":"https://alt.mysite.com:8443/","scheme":"","host":"alt.mysite.com:8443","path":"/","method":"GET","tls":true,"requestIp":"1.2.3.4:41409","headers":{"Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8","Accept-Encoding":"gzip, deflate, br, zstd","Accept-Language":"en-CA,en-US;q=0.7,en;q=0.3","Priority":"u=0, i","Sec-Fetch-Dest":"document","Sec-Fetch-Mode":"navigate","Sec-Fetch-Site":"none","Sec-Fetch-User":"?1","Sec-Gpc":"1","Te":"trailers","Upgrade-Insecure-Requests":"1","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:141.0) Gecko/20100101 Firefox/141.0","X-Forwarded-Host":"alt.mysite.com:8443","X-Forwarded-Port":"8443","X-Forwarded-Proto":"https","X-Forwarded-Server":"7d0cda26f0c","X-Real-Ip":"1.2.3.4"}} pangolin | 2025-07-26T03:38:51.244Z [debug]: Request IP: {"requestIp":"1.2.3.4:41409"} pangolin | 2025-07-26T03:38:51.246Z [debug]: Client IP: {"clientIp":"6.7.8.9"} pangolin | 2025-07-26T03:38:51.249Z [debug]: Resource not found {"0":"a","1":"l","2":"t","3":".","4":"m","5":"y","6":"s","7":"i","8":"t","9":"e","10":".","11":"c","12":"o","13":"m","14":"8","15":"4","16":"4","17":"3"} pangolin | 2025-07-26T03:38:51.250Z [debug]: {"data":{"valid":false},"success":true,"error":false,"message":"Access denied","status":200} ``` Suggestion: - Strip the port when matching against a resource or - Allow users to enter a port with the resource (there are many reasons to run on ports other than 80+443, including firewall issues/configs or if an existing webserver etc is also binding that port)

MrUnknownDE added the enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement labels 2026-04-05 18:27:12 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1178